Public bug reported: A new release of freetype is available for merging from Debian.
Ubuntu: 2.14.3+dfsg-1ubuntu1 Debian Unstable: 2.14.3+dfsg-2 ### New Debian Changes ### freetype (2.14.3+dfsg-2) unstable; urgency=medium * debian/patches: Fix CVE-2026-50811 (Closes: #1141704). * Remove debian/freetype2-doc.lintian-overrides. -- Hugh McMaster <[email protected]> Fri, 24 Jul 2026 21:55:56 +1000 ### Old Ubuntu Delta ### freetype (2.14.3+dfsg-1ubuntu1) stonking; urgency=medium * SECURITY UPDATE: OOB read in TT_Get_Var_Design implementation - debian/patches/CVE-2026-50811-1.patch: Zero extras in src/truetype/ttgxvar.c. - debian/patches/CVE-2026-50811-2.patch: Updated in src/type1/t1load.c. - CVE-2026-50811 -- Marc Deslauriers <[email protected]> Thu, 16 Jul 2026 10:51:20 -0400 ** Affects: freetype (Ubuntu) Importance: Wishlist Status: New ** Tags: dcr-merge ** Changed in: freetype (Ubuntu) Importance: Undecided => Wishlist ** Changed in: freetype (Ubuntu) Milestone: None => ubuntu-26.05 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163527 Title: Merge freetype 2.14.3+dfsg-2 from Debian for stonking cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/freetype/+bug/2163527/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
